Back to results
US 2014/0372991 A1Published application
System, method, and computer program product for simulating at least one of a virtual environment and a debugging environment to prevent unwanted code from executing
AssigneeMcAfee, Inc.
InventorsDIRK KOLBERG, LUKESH Kumar, KEVIN ANDREW GUDGION
Life of this patent
Estimating the term…
Abstract
A system, method, and computer program product are provided for simulating at least one of a virtual environment and a debugging environment to prevent unwanted code from executing. In use, at least one of a virtual environment and a debugging environment is simulated. Additionally, unwanted code is prevented from executing as a result of the simulation.
Claims20
A machine-readable medium on which are stored instructions, comprising instructions that when executed cause a machine to:
- identify a request to execute an executable file;
- disable simulation of a virtual environment or a debugging environment responsive to a determination that the executable file is not protected or packed;
- enable simulation of the virtual environment or debugging environment responsive to a determination that the executable file is protected or packed;
- wherein simulation causes execution of the executable file to appear to be executing in the virtual or debugging environment even though elements of the simulated virtual or debugging environment are not present on the machine.
1 more element
A method, comprising:
- identifying a request to execute an executable file;
- disabling simulation of a virtual environment responsive to a determination that the executable file is not protected or packed;
- enabling simulation of the virtual environment responsive to a determination that the executable file is protected or packed, comprising:
- causing execution of the executable file to appear to be executing in the virtual environment even though elements of the simulated virtual environment are not present on the machine.
1 more element
A system, comprising:
- a processor;
- a memory on which are stored instructions, comprising instructions that when executed cause the processor to:
- identify a request to execute an executable file;
- disable simulation of a virtual environment or a debugging environment responsive to a determination that the executable file is not protected or packed;
- enable simulation of the virtual environment or debugging environment responsive to a determination that the executable file is protected or packed;
- wherein simulation causes execution of the executable file to appear to be executing in the virtual or debugging environment even though elements of the simulated virtual or debugging environment are not present on the system.
3 more elements
Dependencies are inferred from the claim text.